CVE catalog
CVE-2020-8035
php-horde: CVE-2020-8035
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.88% · Oct 25, 2026
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | php-horde | sid | 5.2.23+debian0-6 | fixed |
| Debian | php-horde | bookworm | 5.2.23+debian0-6 | fixed |
| Ubuntu | php-horde | 16.04 | 5.2.7+debian0-1 | vulnerable |
| Ubuntu | php-horde | 16.04 | 5.2.8+debian0-1 | vulnerable |
| Ubuntu | php-horde | 16.04 | 5.2.9+debian0-1 | vulnerable |
| Ubuntu | php-horde | 16.04 | 5.2.9+debian0-1build1 | vulnerable |
| Ubuntu | php-horde | 18.04 | 5.2.16+debian0-1 | vulnerable |
| Ubuntu | php-horde | 18.04 | 5.2.17+debian0-1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [php-horde]Fixed
Details (2)
5.2.23+debian0-6· all · bookwormFixed · Fixed:
5.2.23+debian0-1dsa · php-horde · debian · bookworm; dsa · php-horde · debian · 12
5.2.23+debian0-6· all · bookwormFixed · Fixed:
5.2.23+debian0-1dsa · php-horde · debian · bookworm; dsa · php-horde · debian · 12
Observed: